AI Security Atlas › All entries › RAG & Knowledge Retrieval Security
Embedding Inversion & Membership Inference
An attacker with access to stored vectors reconstructs the source text or learns whether a specific record is in the index.
Open in the interactive atlas →Impact
Confidential document content is recovered from data that teams assumed was anonymized.
Why this severity
Impact High × Likelihood Low = Medium
Impact high: source text can be recovered. Likelihood low: shown in research, and it requires access to raw vectors.
Impact High: Code execution, credential compromise, exposure of regulated or confidential data, irreversible actions, or system-wide failure.
Likelihood Low: No public cases yet, or the attack needs privileged or insider access.
Method: OWASP Risk Rating Methodology
Evidence
- Research: Text Embeddings Reveal (Almost) As Much As Text (arXiv 2310.06816, 2023)
Related
Exploits
- Embeddings Treated as Non-Sensitive Vulnerability · Medium severity
- Over-Privileged Retrieval Indexing Vulnerability · High severity
Mitigated by
- Protect Embeddings as Sensitive Data Guardrail · Fixes medium risks
Remediation
- Treat embeddings with the same classification as their source documents.
- Never return raw vectors through public APIs.
- Restrict and log direct access to the vector store.
How to verify
- Attempt inversion on a sample of stored vectors in a red-team exercise.
- Confirm API responses contain no raw embedding arrays.
Framework mapping
OWASP Top 10 for LLM Applications 2025
- LLM08:2025 Vector and Embedding Weaknesses
- LLM02:2025 Sensitive Information Disclosure
MITRE ATLAS
- AML.T0024.001 Exfiltration via AI Inference API: Invert AI Model
- AML.T0024.000 Exfiltration via AI Inference API: Infer Training Data Membership
NIST AI RMF 1.0
- MEASURE 2.10 Privacy risk of the AI system is examined and documented